Skip to content
Kindgi

List sign-in audit events

GET
/v1/audit/sign-ins
curl --request GET \
  --url 'https://example.com/v1/audit/sign-ins?limit=25&kind=signed-in&order=asc' \
  --header 'Authorization: Bearer <token>'

The tenant’s sign-in history: who signed in and out, how (method), when and from where (clientAddress), what was refused and why, and emailed links sent or capped. ?userId= narrows to one person’s own sign-ins and sign-outs. Oldest first; ?order=desc for newest first. A tenant admin’s to read (403 permission-denied otherwise). Only mounted when CreateAppInput.auditEvents is wired.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
limit
integer
default: 25 >= 1 <= 100

1..100. Default 25.

cursor
string

Where the previous page ended: its nextCursor, as it came. A runtime that seals cursors takes one only for the same list, filters and caller, within a day; otherwise 400 bad-input, and the list starts again without it. Absent → first page.

userId
string

One person’s own sign-ins and sign-outs.

kind
string
Allowed values: signed-in signed-out sign-in-refused sign-in-link-sent sign-in-link-capped sessions-revoked sessions-ended

One kind of event.

from
string format: date-time

Inclusive lower bound on timestamp.

to
string format: date-time

Inclusive upper bound on timestamp.

order
string
Allowed values: asc desc

asc (the default): oldest first. desc: newest first. nextCursor continues in the same order.

Responses

Section titled “Responses”

200

Section titled “200”

A page of sign-in audit events.

Media typeapplication/json
object
data
required
Array<object>

One sign-in audit event, flattened: who signed in or out, how, from where, and what was refused.

object
id
required
string
timestamp
required
string format: date-time
kind
required

signed-in / signed-out; sign-in-refused (with reason); sign-in-link-sent / sign-in-link-capped (an emailed link, for userId; reason is the limit that held); sessions-revoked (“sign out everywhere”, or removing a person); sessions-ended (a changed boot token).

string
Allowed values: signed-in signed-out sign-in-refused sign-in-link-sent sign-in-link-capped sessions-revoked sessions-ended
outcome
required

succeeded or denied.

string
userId

The person: who signed in or out, or whom a link was for. Absent on a refusal.

string
method

How: api-token, email-link, google, microsoft, github, or a workspace identity provider’s id.

string
clientAddress

The client’s address, as the runtime trusts it.

string
reason

Why a sign-in was refused, or which limit held.

string
sessionId
string
hasMore
required
boolean
nextCursor
string
Example
{
  "data": [
    {
      "kind": "signed-in"
    }
  ]
}

400

Section titled “400”

Malformed cursor, kind, from, to, or order.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Section titled “401”

Missing / malformed / expired / revoked bearer token.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

403

Section titled “403”

Not a tenant admin (permission-denied).

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}